Sitecore Workflow Security

1
votes

I have a case scenario where I want a role to be able to execute workflow commands (approve/reject) item which is in "review state" , but they should not be able to edit the item in that state.

I tried doing the following:for "review" state ,for the role.

  1. Allow the write access to the role for the content item
  2. Deny access for "Workflow state write"
  3. Allow access for "Workflow command execute"

But this doesn't behave as expected. I see this message "You cannot edit this item because you do not have write access to it." (expected) . BUT, Deny "workflow state write" also hides the command buttons

I see some weird pattern - I start off by allowing write access everywhere (content Item write and workflow state write) -

  1. Move item thru workflow , reach the review step (now has both buttons and edit permissions) .
  2. Now I go back to security editor and "deny the workflow state write" for the role, for the review state.
  3. I refresh content item , I now see the command buttons AND a different message "You cannot edit this item because it is in a workflow state that you do not have write access to."

This weird pattern is the behavior I want , however I cannot seem to duplicate it with out real time permission edits. Please help.

1
securitysitecoreworkflowsitecore8

1 Answers

0
votes

The way Sitecore works is that you can only execute commands in workflow if you have write rights on that particular item.

From the Workflow Reference document (which is written for Sitecore 6, but is still applicable):

The effective access rights on an item can influence the behavior of the Workbox application. A user must have write access to an item in order to see the item in the Workbox. Note that a user may not have write access to an item if the item is currently checked out (locked) by another user.

The last part there might be interesting for you - although I don't know whether it's possible to push an item through workflow if it's been locked by someone else...

The only other option that comes to mind is to programmatically set the DisableWebEdit property on Sitecore controls when in a particular state of the workflow, but that might be a bit much.